Contributor SQL Injection in MapSVG <= 8.14.0 versions.
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.
Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended store base directory. Attackers can supply path traversal sequences in the conversation_id parameter submitted to the unauthenticated chat API endpoints to escape the base directory during both write and r